Tableau & BI tools
Tableau reads tables and views through a read-only HTTP feed — under each analyst's own account. There is no service account: grants and policies apply unchanged, and every fetch is written to the audit log.
On this page
Why there is no dedicated plugin
Tableau's own extension paths for web data have been retired: Web Data Connector 2.x was removed in Tableau 2023.1, and WDC 3.0 is deprecated as well. Tableau's recommended successor is the REST API Connector from the Tableau Exchange — built and signed by Tableau, reading an HTTP GET endpoint. The platform provides exactly that endpoint instead of maintaining a plugin of its own.
Side effect: the same feed is readable from Power BI Web, Excel or a script with no extra work — under identical governance.
1. Switching the feed on (administration)
As shipped, the feed is off; every fetch is refused with 403, regardless of the caller's rights. Letting data out is a deliberate act — under Daten → BI-Anbindung (data → BI connectivity).
| Setting | Meaning |
|---|---|
| Feed enabled | The switch. Off = every fetch 403. Takes effect immediately, no restart. |
| Rows per page (cap) | Upper bound for limit. It can only lower the hard limit in code (50,000). |
| Allowed catalogs | Empty = no additional restriction. Filled = allowlist: only these catalogs may leave through Tableau. |
The allowlist complements the grants
It is a second barrier in front of Trino, answering which data may leave the building towards BI. Who may see what is still decided by the grants.
2. Authentication
The feed accepts only the platform's normal bearer authentication: a Keycloak access token of the realm with audience agent. A token for a different audience is refused with 401. Two routes lead there:
- Bearer token — the analyst stores an access token in the connector. Short-lived, so it suits one-off or manually triggered extracts only.
- OAuth — recommended for scheduled refreshes. A dedicated public client for Tableau is created in the realm (standard flow, PKCE, the redirect URI documented by your Tableau version, plus an audience mapper to agent).
3. Prerequisites in Tableau
Tableau 2023.3 or newer
Install the REST API Connector
From the Tableau Exchange; place the .taco file in your installation's connectors directory.
Drop in the JDBC REST API driver
The .jar goes into your platform's driver directory.
Windows: C:\Program Files\Tableau\Drivers macOS: ~/Library/Tableau/Drivers Linux: /opt/tableau/tableau_driver/jdbcRestart Tableau
The connector works as an extract; there is no live connection. That is a property of the connector, not a limitation of the platform.
4. The data source URL
The console builds the finished URL under BI-Anbindung → generate data source URL, with a copy button. It has this shape:
https://<host>/api/agent/tableau/rows?catalog=<catalog>&schema=<schema>&table=<table>&limit=10000&orderBy=<column>| Parameter | Required | Meaning |
|---|---|---|
| catalog, schema, table | yes | The object — table or view — in the lakehouse. |
| limit | no | Rows per page. Default 10,000, capped by the settings. |
| offset | no | First row of the page; this is how Tableau pages. |
| orderBy | from page 2 | Sort key: column, column:desc, several comma-separated, or * for all columns. |
| format | no | json (default) or csv. |
There is no SQL parameter, and that is deliberate. The feed builds the query itself from the named object, validated identifiers and numbers. If you need a computed analysis, define it as a view in the lakehouse — then the policies apply there too.
orderBy is mandatory from the second page
OFFSET without ORDER BY is not stable in Trino — as in any parallel engine — two queries may return the same rows in a different order. An extract spanning several pages could contain rows twice and lose others without any error surfacing. The feed therefore refuses offset > 0 without orderBy, answering 400 order_required rather than serving an unreliable page. The first page needs no sort key.
5. Setting up the connector
| Field | Value |
|---|---|
| URL / endpoint | The URL from step 4 |
| Response format | JSON (or CSV with format=csv) |
| JSONPath to the records | $.data |
| Authentication | Bearer token or OAuth |
| Pagination | offset/limit under exactly those parameter names, page size = your limit |
| TLS certificate check | Leave enabled |
6. Common error responses
| Response | Meaning | Remedy |
|---|---|---|
| 401 | Missing or expired token, or wrong audience | Renew the token; aud must be agent |
| 403 bridge_disabled | The feed is switched off | Administrator: console → BI-Anbindung |
| 403 catalog_not_allowed | The catalog is not on the allowlist | Administrator: maintain the allowlist |
| 404 not_found | The object does not exist, or is not visible to you | Check the grants in Trino — the two look identical on purpose |
| 400 order_required | Paging without a sort key | Add orderBy |
| 422 no_deliverable_columns | No column of the object can be delivered | Create a view with converted columns |
Worth knowing
- Metrics and semantic views cannot yet be addressed through the feed directly — until then, store the metric as a view in the lakehouse.
- Columns whose types Tableau does not know are omitted rather than guessed, and reported as unsupported in the schema.
- hasMore is derived from rowCount === limit, so the last page of an extract may come back empty once.
After that, Tableau's rules apply
A finished extract lives in Tableau under Tableau's own permissions. Grants on the Tableau side deserve the same care as in the lakehouse.
Applies to: This page describes lavalake 0.16.0. Product and documentation live in separate repositories — when in doubt, what the console shows is authoritative.
Something missing?
If these pages do not answer your question, we will walk through the platform against your own case in half an hour.
Book a demo